Log message:
Bump PKGREVISION for security/openssl ABI bump.

Log message:
Use OPSYSVARS.

Log message:
Update bind910 to 9.10.3pl3 (BIND 9.10.3-P3).

Security Fixes

     * Specific APL data could trigger an INSIST. This flaw was discovered
       by Brian Mitchell and is disclosed in CVE-2015-8704. [RT #41396]
     * Certain errors that could be encountered when printing out or
       logging an OPT record containing a CLIENT-SUBNET option could be
       mishandled, resulting in an assertion failure. This flaw was
       discovered by Brian Mitchell and is disclosed in CVE-2015-8705. [RT
       #41397]
     * Named is potentially vulnerable to the OpenSSL vulnerabilty
       described in CVE-2015-3193.
     * Insufficient testing when parsing a message allowed records with an
       incorrect class to be be accepted, triggering a REQUIRE failure
       when those records were subsequently cached. This flaw is disclosed
       in CVE-2015-8000. [RT #40987]
     * Incorrect reference counting could result in an INSIST failure if a
       socket error occurred while performing a lookup. This flaw is
       disclosed in CVE-2015-8461. [RT#40945]

New Features

     * None.

Feature Changes

     * Updated the compiled in addresses for H.ROOT-SERVERS.NET.

Bug Fixes

     * Authoritative servers that were marked as bogus (e.g. blackholed in
       configuration or with invalid addresses) were being queried anyway.
       [RT #41321]

Log message:
Update bind910 package to 9.10.3pl2 (BIND 9.10.3-P2), security release.

	--- 9.10.3-P2 released ---

4270.	[security]	Update allowed OpenSSL versions as named is
			potentially vulnerable to CVE-2015-3193.

4261.	[maint]		H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53.
			[RT #40556]

4260.	[security]	Insufficient testing when parsing a message allowed
			records with an incorrect class to be be accepted,
			triggering a REQUIRE failure when those records
			were subsequently cached. (CVE-2015-8000) [RT #40987]

4253.	[security]	Address fetch context reference count handling error
			on socket error. (CVE-2015-8461) [RT#40945]

	--- 9.10.3-P1 (withdrawn) ---

Log message:
Update bind910 to 9.10.3.

Security Fixes

     * An incorrect boundary check in the OPENPGPKEY rdatatype could
       trigger an assertion failure. This flaw is disclosed in
       CVE-2015-5986. [RT #40286]
     * A buffer accounting error could trigger an assertion failure when
       parsing certain malformed DNSSEC keys.
       This flaw was discovered by Hanno Böck of the Fuzzing Project, and
       is disclosed in CVE-2015-5722. [RT #40212]
     * A specially crafted query could trigger an assertion failure in
       message.c.
       This flaw was discovered by Jonathan Foote, and is disclosed in
       CVE-2015-5477. [RT #40046]
     * On servers configured to perform DNSSEC validation, an assertion
       failure could be triggered on answers from a specially configured
       server.
       This flaw was discovered by Breno Silveira Soares, and is disclosed
       in CVE-2015-4620. [RT #39795]

New Features

     * New quotas have been added to limit the queries that are sent by
       recursive resolvers to authoritative servers experiencing
       denial-of-service attacks. When configured, these options can both
       reduce the harm done to authoritative servers and also avoid the
       resource exhaustion that can be experienced by recursives when they
       are being used as a vehicle for such an attack.
       NOTE: These options are not available by default; use configure
       --enable-fetchlimit to include them in the build.
          + fetches-per-server limits the number of simultaneous queries
            that can be sent to any single authoritative server. The
            configured value is a starting point; it is automatically
            adjusted downward if the server is partially or completely
            non-responsive. The algorithm used to adjust the quota can be
            configured via the fetch-quota-params option.
          + fetches-per-zone limits the number of simultaneous queries
            that can be sent for names within a single domain. (Note:
            Unlike "fetches-per-server", this value is not self-tuning.)
       Statistics counters have also been added to track the number of
       queries affected by these quotas.
     * dig +ednsflags can now be used to set yet-to-be-defined EDNS flags
       in DNS requests.
     * dig +[no]ednsnegotiation can now be used enable / disable EDNS
       version negotiation.
     * An --enable-querytrace configure switch is now available to enable
       very verbose query tracelogging. This option can only be set at
       compile time. This option has a negative performance impact and
       should be used only for debugging.

Feature Changes

     * Large inline-signing changes should be less disruptive. Signature
       generation is now done incrementally; the number of signatures to
       be generated in each quantum is controlled by
       "sig-signing-signatures number;". [RT #37927]
     * The experimental SIT extension now uses the EDNS COOKIE option code
       point (10) and is displayed as "COOKIE: <value>". The existing
       named.conf directives; "request-sit", "sit-secret" and
       "nosit-udp-size", are still valid and will be replaced by
       "send-cookie", "cookie-secret" and \ 
"nocookie-udp-size" in BIND
       9.11. The existing dig directive "+sit" is still valid and will be
       replaced with "+cookie" in BIND 9.11.
     * When retrying a query via TCP due to the first answer being
       truncated, dig will now correctly send the COOKIE value returned by
       the server in the prior response. [RT #39047]
     * Retrieving the local port range from net.ipv4.ip_local_port_range
       on Linux is now supported.
     * Active Directory names of the form gc._msdcs.<forest> are now
       accepted as valid hostnames when using the check-names option.
       <forest> is still restricted to letters, digits and hyphens.
     * Names containing rich text are now accepted as valid hostnames in
       PTR records in DNS-SD reverse lookup zones, as specified in RFC
       6763. [RT #37889]

Bug Fixes

     * Asynchronous zone loads were not handled correctly when the zone
       load was already in progress; this could trigger a crash in zt.c.
       [RT #37573]
     * A race during shutdown or reconfiguration could cause an assertion
       failure in mem.c. [RT #38979]
     * Some answer formatting options didn't work correctly with dig
       +short. [RT #39291]
     * Malformed records of some types, including NSAP and UNSPEC, could
       trigger assertion failures when loading text zone files. [RT
       #40274] [RT #40285]
     * Fixed a possible crash in ratelimiter.c caused by NOTIFY messages
       being removed from the wrong rate limiter queue. [RT #40350]
     * The default rrset-order of random was inconsistently applied. [RT
       #40456]
     * BADVERS responses from broken authoritative name servers were not
       handled correctly. [RT #40427]
     * Several bugs have been fixed in the RPZ implementation:
          + Policy zones that did not specifically require recursion could
            be treated as if they did; consequently, setting
            qname-wait-recurse no; was sometimes ineffective. This has
            been corrected. In most configurations, behavioral changes due
            to this fix will not be noticeable. [RT #39229]
          + The server could crash if policy zones were updated (e.g. via
            rndc reload or an incoming zone transfer) while RPZ processing
            was still ongoing for an active query. [RT #39415]
          + On servers with one or more policy zones configured as slaves,
            if a policy zone updated during regular operation (rather than
            at startup) using a full zone reload, such as via AXFR, a bug
            could allow the RPZ summary data to fall out of sync,
            potentially leading to an assertion failure in rpz.c when
            further incremental updates were made to the zone, such as via
            IXFR. [RT #39567]
          + The server could match a shorter prefix than what was
            available in CLIENT-IP policy triggers, and so, an unexpected
            action could be taken. This has been corrected. [RT #39481]
          + The server could crash if a reload of an RPZ zone was
            initiated while another reload of the same zone was already in
            progress. [RT #39649]
          + Query names could match against the wrong policy zone if
            wildcard records were present. [RT #40357]

Log message:
Add SHA512 digests for distfiles for net category

Problems found with existing digests:
	Package haproxy distfile haproxy-1.5.14.tar.gz
	159f5beb8fdc6b8059ae51b53dc935d91c0fb51f [recorded]
	da39a3ee5e6b4b0d3255bfef95601890afd80709 [calculated]

Problems found locating distfiles:
	Package bsddip: missing distfile bsddip-1.02.tar.Z
	Package citrix_ica: missing distfile citrix_ica-10.6.115659/en.linuxx86.tar.gz
	Package djbdns: missing distfile djbdns-1.05-test25.diff.bz2
	Package djbdns: missing distfile djbdns-cachestats.patch
	Package djbdns: missing distfile 0002-dnscache-cache-soa-records.patch
	Package gated: missing distfile gated-3-5-11.tar.gz
	Package owncloudclient: missing distfile owncloudclient-2.0.2.tar.xz
	Package poink: missing distfile poink-1.6.tar.gz
	Package ra-rtsp-proxy: missing distfile rtspd-src-1.0.0.0.tar.gz
	Package ucspi-ssl: missing distfile ucspi-ssl-0.70-ucspitls-0.1.patch
	Package waste: missing distfile waste-source.tar.gz

Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden).  All existing
SHA1 digests retained for now as an audit trail.

Log message:
Update bind910 to 9.10.2pl4 (BIND 9.10.2-P4).
(Already fixed by bind-9.10.2pl3nb1.)

	--- 9.10.2-P4 released ---

4170.	[security]	An incorrect boundary check in the OPENPGPKEY
			rdatatype could trigger an assertion failure.
			(CVE-2015-5986) [RT #40286]

4168.	[security]	A buffer accounting error could trigger an
			assertion failure when parsing certain malformed
			DNSSEC keys. (CVE-2015-5722) [RT #40212]

Log message:
Patch CVE-2015-5722 & CVE-2015-5986
Bump rev

CVE-2015-5722 - Parsing malformed keys may cause BIND to exit due to a failed
assertion in buffer.c
https://kb.isc.org/article/AA-01287/0

CVE-2015-5986 - An incorrect boundary check can trigger a REQUIRE assertion
failure in openpgpkey_61.c
https://kb.isc.org/article/AA-01291/0

Reviewed by wiz@

Log message:
Update bind910 to 9.10.2pl3 (BIND 9.10.2-P3).

	--- 9.10.2-P3 released ---

4165.	[security]	A failure to reset a value to NULL in tkey.c could
			result in an assertion failure. (CVE-2015-5477)
			[RT #40046]

Log message:
Update bind910 to 9.10.2pl2.

	--- 9.10.2-P2 released ---

4138.	[bug]		An uninitialized value in validator.c could result
			in an assertion failure. (CVE-2015-4620) [RT #39795]